Betterleaks
Free secrets scanner from Gitleaks' original creator: finds leaked API keys and passwords in code with far fewer false positives.
🔗 Visit Betterleaks
Description
Developers sometimes accidentally commit a password or API key into their code, where it can sit exposed in a repository forever — a surprisingly common way companies get hacked. Betterleaks is a free tool that scans code for exactly this kind of accident and flags it before it becomes a breach.
Betterleaks is an open-source secrets scanner that detects leaked credentials, API keys and sensitive information across Git repositories, GitHub, GitLab, Hugging Face and S3. It was built by Zach Rice, the original creator of the widely-used Gitleaks, as a full drop-in replacement — existing Gitleaks CLI flags and config files work unchanged. Rather than relying mainly on entropy calculations (a common source of false positives in older scanners), Betterleaks uses a token-efficiency approach based on BPE tokenization plus rule-defined validation written in Common Expression Language (CEL), reporting 98.6% recall versus 70.4% for entropy-based detection on the CredData benchmark. It's written in pure Go with no CGO or Hyperscan dependency, supports async HTTP-based validation of found secrets, and handles multiply-encoded secrets by default. Sponsored by Aikido Security, it launched March 19, 2026 and is MIT licensed.
💬 Our review
The short version: the person who built the industry-standard secret scanner rebuilt it from scratch, it's free, it's a drop-in replacement, and the accuracy numbers are a real improvement — there's little reason not to switch.
What makes Betterleaks credible isn't marketing, it's provenance: Zach Rice created Gitleaks, watched it become the de facto standard, then rebuilt the detection approach after losing control of the original project — he has more insight into where entropy-based scanning fails than almost anyone. The 98.6% vs 70.4% recall gap on CredData is a meaningful jump, and full CLI/config compatibility means teams already running Gitleaks in CI can switch with essentially no migration cost. Pure Go with no CGO/Hyperscan dependency also simplifies cross-platform builds and containers. The honest caveats for a March 2026 launch: it's young (roughly 1,500 GitHub stars at last check), the rule library for less common authentication providers is still expanding, and teams with heavily customized Gitleaks rulesets should verify their specific rules port over cleanly before flipping the switch in production CI. For anyone starting a secret-scanning setup today, or running vanilla Gitleaks, this is a safe and free upgrade; teams with deep custom Gitleaks tuning should pilot it first.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Fully open source, MIT license, no paid tier
Pros
Drop-in Gitleaks replacement, zero migration friction
98.6% recall vs 70.4% for entropy-based scanning
Free, MIT licensed, pure Go
Cons
Young project (March 2026 launch)
Rule library for niche providers still expanding